L1TF related “esx.problem.hyperthreading.unmitigated” vCenter Server Updates: CVE-2018-3646

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

After applying the ESXi patches in VMSA-2018-0020 or patches from later releases, vCenter Server displays one of these L1 Terminal Fault related notifications:

 

                  XXX esx.problem.hyperthreading.unmitigated.formatonhost not found XXX

                   or

                   esx.problem.hyperthreading.unmitigated

Environment

VMware vSphere ESXi 7.0.x
VMware vSphere ESXi 6.0
VMware vSphere ESXi 6.7
VMware vSphere ESXi 5.5
VMware vSphere ESXi 6.5

Cause

The ESXi patches available in VMSA-2018-0020 to mitigate CVE-2018-3646 introduced a new notification to indicate the remediation status of the 'L1 Terminal Fault' (L1TF - VMM) vulnerability. When ESXi is updated before vCenter, either manually or through vSphere Update Manager, the internal reference for the message from the host instead of the intended one is displayed. With an US English locale, the notification reads:

This host is potentially vulnerable to issues described in CVE-2018-3646, please refer to VMware Overview of ‘L1 Terminal Fault’ : for details and VMware recommendations.

Resolution

Update vCenter, this will translate the internal reference notification into the respective language. If you would like to suppress the notification regardless of how it is displayed, you can do so by changing the value of the ESXi advanced option UserVars.SuppressHyperthreadWarning from 0 to 1. Note that this should only be done after reviewing KB and its related articles.

Note: In case the warning still shows up after making the above changes, the Host may need to be rebooted for the changes to take effect.